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We show that the fidelity result of entanglement purifi- 
cation protocol with 2-way classical communications (C. H. 
Bennett et al, Phys. Rev. Lett., 76, 722(1996)) is always 
correct with whatever initial states. We then give a general 
criteria on the unconditional entanglement purification: if a 
protocol satisfies our condition, the fidelity result of the pro- 
tocol with the product form of initial state for the raw pairs is 
also correct for the same protocol with arbitrary initial state 
for of the raw pairs. With this general condition, we conclude 
that all existing purification protocols can work uncondition- 
ally. 

Quantum entanglement is one of the most important 
resources in quantum information processing [1]. There 
are purification protocols on how to distill almost per- 
fect entangled pairs (EPR pairs) from a larger number 
lower quality pairs, by only local operations and classical 
communications. There are different types of entangle- 
ment purification protocols [2-6]. In the earliest proto- 
cols [2-4] , it was assumed that those raw pairs shared by 
Alice and Bob are in a product state: there are no en- 
tanglement among those pairs. The idea of entanglement 
purification was then used to the very important prob- 
lem of security proof of quantum key distribution(QKD) 
[8] : if Alice and Bob can share almost perfect EPR pairs 
through purification, they can share a secret key by mea- 
suring each pairs in the same basis on each side. This idea 
first appeared in Ref [4], with the advantage distillation 
protocol [3]. However, since the purification protocol it- 
self assumes the product state for the initially shared raw 
pairs, it was concerned in Ref [4] that: "if Eve provides 
pairs which are entangled with each other" , then the re- 
mained pairs after distillation "may not converge to the 
pure state \(j> + ) (4> + 1" . It was then shown by Lo and Chau 
[7] that the result of hashing protocol given by Bennett 
et al [2] is actually correct with whatever form of initial 
states therefore a type of security proof for QKD was 
strictly set up. After that, Shor and Preskill show that 
Lo-Chau's security proof can be reduced to the BB84 
protocol which contains no difficult techniques such as 
quantum storage or collective measurements. (We shall 
call this type of protocol as prepare-and-measure proto- 
col.) In the whole security proof of the BB84 [8] protocol 
based on viewpoint of entanglement purification, there 
are two important steps: (1), the entanglement purifica- 
tion protocol actually works unconditionally, with what- 
ever type of initial state; (2), the purification can be clas- 
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sicalized therefore on can reduce it to a type of prepare- 
and-measure QKD protocol, the standard BB84. Latter, 
the second step was studied in a more general background 
and a general condition on classicalization was given [6] . 
With such a generalization, one does not have to specifi- 
cally construct the classicalization step in a new protocol. 
Instead, one may directly use the main theorem in Ref 
[6]. However, so far there is no general statement on 
step 1, the unconditional entanglement purification. Say, 
given a purification protocol with product form of initial 
state for the raw pairs, under which condition the fidelity 
result of the final pairs is still correct given whatever ini- 
tial state for the raw pairs. In this Letter, we study this 
problem and shall give a general condition for the uncon- 
ditional entanglement purification. With our theorem, 
we find that all existing purification protocols can work 
unconditionally. 

For clarity, we shall consider the details of a special 
case first, the (modified) advantage distillation [3,4]. This 
is a 2-pair error-rejection protocol with 2-way classical 
communications (2-CC). We then state our general theo- 
rem and consider other entanglement purification proto- 
cols [2,6] with our theorem. Note that so far no one has 
shown explicitly that the 2-CC protocol works uncondi- 
tionally with whatever type of channel noise, though the 
question to protocol with 1 way classical communications 
(1-CC) [2] has been studied [7]. Our main contribution 
here is to give a general statement of the condition for 
unconditional entanglement purification. Since our proof 
is closely related to Lo-Chau's security proof [7], we re- 
gard our result as generalized effects of Lo-Chau's secu- 
rity proof. 

Let's first state our main idea. If the initial state is not 
a product form, classical statistics does not necessarily 
work. Therefore we should not blindly assume anything 
of classical statistics, including the error estimation from 
samples. To make everything clear, we shall start from 
a silly protocol where Alice and Bob take a dark Bell 
measurement (i.e. a Bell measurement without reading 
the measurement result) to each raw pairs. After this 
step, we can safely define the rates of each Bell states 
for the raw pairs by classical statistics. We regard state 
\4> + ) as the perfect EPR state. Therefore in the case 
that a dark Bell measurement has been done to each raw 
pairs, the state for raw pairs is in a product form. In 
the estimation, we let Alice and Bob do collective mea- 
surements XX, YY, ZZ to test pairs. These collective 
measurements are just the parity measurement in differ- 
ent bases, e.g., the measurement result of XX is or 1 
if the bit values in X basis in two sides of the measured 
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pair are same or different. Since all these parity measure- 
ments commute, classical sampling theory works exactly 
in estimating the rate of different Bell states. After mea- 
suring the test pairs, they know the distribution over 4 
Bell states for the remained raw pairs by the classical 
sampling theory. Also, in our initial protocol, all opera- 
tions commute and classical statistics works throughout 
the whole protocol. The fidelity between the finally dis- 
tilled m pairs and the m products of perfect EPR state 
(| </>+)) is given by classical statistics. We then show that 
the initial dark Bell measurement to each raw pairs can 
be deleted and all the collective measurements involved 
in the protocol can be replaced by local measurement on 
A, Y", Z basis in each side with the fidelity of the distilled 
m pairs being unchanged. Eve's information is limitted 
by the Holevo bound [7] therefore if the fidelity of the 
distilled m pairs is sufficiently close to 1, her amount of 
information to the final key is negligible. 

We denote Z, A, Y as measurement in the bases of 
{|0>, |1», {|±) = ^(|0) ± |l»},{|y±) = ^(|0> ± i|l»} 
respectively. We use the notation If/^), IV^) for 4 Bell 
states ^(|00) ± |11}), -j= (|01) ± |10)). We shall use 
WW for collective measurement to a pair in W basis 
and W W for local measurement in W basis in each 
side, where W can be A, Y or Z. In the purification pro- 
tocol we assume intially Alice and Bob share N raw pairs 
and our motivation is to distill m very good pairs finally, 
with its fidelity to state (\<f) + )((f) + \) m being exponentially 
close to 1. 

Consider the following (silly) entanglement purifica- 
tion protocol with everything clearly defined: 
Protocol 1: 

Step 1: Entanglement distribution: Alice prepares N 
perfect EPR pairs, \4> + ] }. She sends half of each pair to 
Bob (over a noisy channey in general) . N is a very large 
natural number. Step 2: Dark Bell measurement: They 
take a Bell measurement to each pair but don't read the 
measurement results. Step 3: Error test. They randomly 
pick out 3k pairs and equally divide them into 3 groups. 
Note that k is large but k << N. They take collective 
measurement of XX to each pair in the first group, YY 
to each pair in the second group and ZZ to each pair in 
the third group. They then send the pairs in group 1,2,3 
to trash can Tx, Ty, Tz, respectively. If too many of the 
measurement results are 1 they abort the protocol; oth- 
erwise they continue. Step 4: Error rejection, a.) Bit-flip 
error rejection. They randomly group the remained pairs 
outside the trash cans with each group containing 2 pairs. 
To each 2-pair group, they collect the parity information 
to one pair (the destination pair) by a controlled-NOT 
[1] operation on each side (bi-CNOT) in Z— basis. They 
take a collective measurement of ZZ to the destination 
pair. If the result is 0, they put the destination pair to 
the trash can Tz and keep the other pair; if it is 1, they 
send the destination pair to trash can Tz and discard 
the other pair permcnantly. b.) Phase-flip error rejec- 
tion. They randomly group the remained pairs outside 



the trash cans with each group containing 2 pairs. To 
each 2-pair group, they collect the A— basis parity infor- 
mation to the destination pair by an A— basis bi-CNOT 
operation. They take a collective measurement of AA 
to the destination pair. If the result is 0, they send the 
destination pair to the trash can Tx and keep the other 
pair, if it is 1, they send the destination to trash can Tx 
and discard the other pair permenantly. They do opera- 
tions in a.) and b.) iteratively until they believe that the 
state of the remained pairs outside the trash cans is very 
close to a product state of </> + )(</>+|. We assume there 
are m pairs remained outside the trash cans then. 

We call this protocol MS M silly protocol because it is 
not useful in any real entanglement purification or QKD, 
due to the fact that Alice and Bob have to come together 
to make the collective measurements. However, it is an 
effective mathematical tool to clearly show the security 
of the final useful protocol. 

We regard a pair as a good pair if it is in state \<j> + )', 
a bad pair if it is in any one of the other 3 Bell states. 
Note that a good pair always has the parity in what 
ever bases of A, Y, Z, while there is always a certain basis 
where a bad pair has the parity 1 for sure. After Step 

2 all quantum entanglement among different pairs arc 
removed therefore classical statistics works exactly with 
all measurement bases being commute. In particular, 
after Step 3, the probability of obtaining more than SN Is 
by measurement WW on the remained pairs and finding 
more than (5 — eo)k Is by measurement WW on a group 
of k pairs is less than exp[— \cqN/(6 — S 2 )]. Given the 
joint information of parity value distribution in 3 bases, 
one may calculate the rate of good pairs and each of the 

3 types of bad pairs in remained N — 3k raw pairs. We 
denote qi, q x ,q v , q z for the rate of \(j> + ), \ip + ), \^~), \<P~)- 
The different rates of each of the 4 Bell states after and 
before bit-flip error rejection are related by the following 
formulas [9] 
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Here the left hand sides are the quantities after bit-flip 
rejection operation and the symbols in right hand sides 
of each equations are for the quantities before bit-flip re- 
jection operation. Switching q x and q z we shall obtain 
the relations after and before phase-flip rejection opera- 
tion. This shows that part a.) of Step 4 reduces the rate 
of bad pairs of |^ ± ); part b.) reduces the rate of bad 
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pairs of \<j> ), \ip }. Also, it can be shown that, the rate 
of remained pairs after the Bit-flip rejection is 



2{ qi + qz y + ( qx + Py y K > 

If the initial error rates are small (say, q x = q y = q z = to), 
after g rounds of error rejection, the rate of remained 
pairs is in the magnitude order of AT 9 while the new 
bad-pair rate is in the magnitude order of A 9 tf ' . If to 
is small, a few steps of repetition of error-rejection is 
sufficient. This has been demonstrated numerically by 
Deutsch et al [4]. We conclude that with an appropriate 
number of iteration, the state of the finally remained m 
pairs p m must be exponentially close to m perfect EPR 
pairs, i.e. 

< $ TO |p m |$ ro >= 1-e (3) 

and e is a small number exponentially close to 0, |$ m ) = 

|0+>® m . 

The order of Step 2 and Step 3 can be exchanged since 
the collective measurements in Step 3 are just coarse- 
grained Bell measurements which commute with the dark 
Bell measurements in Step 2. For example, measurement 
ZZ is simply a measurement on whether the pair belongs 
to subspace {(c^)} or subspace {|V' ± )}- 

Consider the bi-CNOT in Z basis. On each side they 
take the unitary operation of |0)|0) |0}|0), |0)|1) -> 
|0}|1), |1)|0) -> |1)|1), |1)|1) -> |1)|0), with the second 
state being the destination qubit. Consequently, if the 
second pair is destination pair, a Z— basis bi-CNOT op- 
eration is a permutation in Bell basis as the following 

\Xi,j)\Xi',j>) — > \Xi®i',j)\Xi',j'®j)- (4) 

Here i,j can be either or 1, |xo,o),|Xi,o),|Xo,i),|xi,i) 
are notations for \<j) + ), \<f>~), , respectively and 

symbol © is the calculation of summation mod 2. This 
permutation operation and the dark Bell measurement 
commute. Proof. Given arbitrary /—pair state pi, one can 
always write in the form pi = J2i \{bi\pi\bi)-bi)(bi\ + o ff, 
where is the Bell bases for I pairs, I is from 1 to 4', 

O ff contains all off-diagonal terms in Bell bases which 
have no contribution to the outcome of Bell measure- 
ment. With the original order of the protocol, i.e., first 
take dark measurement and then take bi-CNOTs, the 
outcome state is pf = P Q^j |(6j|pj|6j) • bi)(bi\) and P 
is the permutation given by bi-CNOTs. If we reverse 
the order, after the bi-CNOTs, the state is changed to 
P(Ei \(k\pi\bi) ■ h){bi\) + P(poff)- Note that with the 
permutation P in Bell bases, the off-diagonal terms will 
be still off-diagonal and the diagonal terms will be still 
diagonal. If we then take the Dark Bell measurement, 
only the diagonal terms survive. This is to say, with the 
order being reversed, the outcome is also pf. This makes 
the proof. 

Similarly, one can show that the X— basis bi-CNOT also 
commutes with the dark Bell measurement. Therefore 



all bi-CNOT operations commute with the Bell measure- 
ment in Step 2. Therefore all operations in Step 4 and 
Step 2 commute, consequently we can exchange the or- 
der of Step 2 and Step 4, i.e. Step 2 in protocol 1 can 
be delayed until the end of the protocol. This dark Bell 
measurement in the end of the protocol can be deleted 
because it does not change the fidelity of the remained 
m pairs. Explicitly, given any state of I pairs, pi, after a 
dark Bell measurement to each pair, the state is changed 
to p\ = Ei(bi\p'i\bi) ■ \bi)(bi\, with {!&,)} being /-Bell 
basis and i running from 1 to A 1 . The fidelity of p\ is 

(bM\bi) = (bi\ YlibMlbi) ■ IWil&i) = (6i|pj|6i> (5) 

i 

and \bi) — \<f) + )® 1 . This shows that, although the dark 
Bell measurement may change the state of remained m 
pairs, it does not change the fidelity. Due to the above 
arguments, we now give the following modified protocol 
for QKD: 
Protocol 2: 

Step 1: Entanglement distribution. Step 2: Error test. 
Step 3: Error rejection. Step 4: Alice and Bob send all 
trash cans to Eve. Step 5: They measure Z <g) Z to each 
of the remained m pairs outside the trash cans and use 
the result as an m— bit final key. 

Step 1-3 are same with those in Protocol 1. As it has 
been argued already, after Step 3 in protocol 2, the state 
of remained m pairs is exponentially close to 1 . There- 
fore Eve's information to the final key is upper bounded 
by a negligibly small number e' [7], even Eve controls 
everything except for the distilled m pairs, including all 
pairs in trash cans and everything else outside Alice and 
Bob's labs. 

This protocol is still useless for any actual entangle- 
ment purification because it requires the collective mea- 
surements though the step of dark Bell measurement to 
each pair has now been removed. Now we show that 
if we replace all collective measurements WW by local 
measurements W (g> W, the final result of the protocol is 
unchanged. 

For such a purpose, we first show that Step 4 can be 
replaced by Step 4': 

Step 4 '■ Alice and Bob don't send any states in trash cans 
to Eve. Instead they take local measurement of W <S> W 
to the pairs in trash cans Tw, (Tw can be Tx, Ty or Tz.) 
and announce the results. 

If we only want an unconditionally secure final key, 
we can use the following simple argument: A restrictive 
Eve cannot do the attack better than an un-restricted 
Eve. Eve in protocol 2 is an un-restricted Eve who con- 
trols everything except for the distilled m pairs. Con- 
sider a restriction requires Eve to measure W W to 
each pairs in trash cans Tw and announce the measure- 
ment results. Note that except for this, Eve's action to 
everything else under her control is not restricted, e.g., 
the ancillas which had been prepared in the most initial 
stage when Alice distributes EPR pairs to Bob. With 
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the above restriction, Eve's information to the final key 
must be also bounded by e' . Or in other words, if Eve's 
information is bounded by e' with whatever attack, her 
information must be also bounded by e' with any specific 
type of attack. Replacing Step 4 with Step 4' in proto- 
col 2 is equivalent to add the above restriction to Eve in 
protocol 2. This is to say, it will cause no harm to the 
security of final key if Alice and Bob keep all trash cans 
and take local measurement VF®!^ to pairs in trash cans 
Tw and announce the measurement outcome. 

We can also show that Step 4 can be replaced by Step 
4' by the fidelity criteria, from the viewpoint of entan- 
glement purification. Consider the case that Step 4 is 
replaced Step 4'. We only need to argue that the lo- 
cal measurement in Step 4' may cause no changes to the 
fidelity of the m remained pairs. Suppose the state of 
the total space immediately after Step 3 is pt — p m ,c,e 
and the subscript m, c, e denote for the subspace of m re- 
mained pairs, trash cans and environment, respectively. 
The state of the remained m pairs immediately after Step 
3 is 

P m = tr Cie pt. (6) 

The notation tr c ^ e means the partial trace calculation in 
subspaces of trash cans and environment. In the proto- 
col, if the error test is passed, Alice and Bob will always 
accept the remained m pairs no matter what the mea- 
surement outcome they may obtain in Step 4'. Therefore 
for the quantity of fidelity of the remained m pairs, we 
only care about the averaged state for the m pairs after 
after Step 4', with the average being taken over all possi- 
ble measurement results in Step 4'. Mathematically, the 
averaged total state after Step 4' is 

p' t =J2(L\p t \L)\L}(L\. (7) 

L 

Here \L) is an eigenstate of the local measurement to 
those qubits in trash cans in Step 4'. Therefore the av- 
eraged state for the remained m pairs after Step 4' is 

p' m = tr c . e p' t =tr e ^2< L\p t \L >= tr c . e p t = p m . (8) 

L 

This shows that the averaged state for the remained m 
pairs after Step 4' is just p mi therefore Step 4' does not 
change the fidelity of the remained m pairs. 

Now we show why all collective measurements WW 
can simply be replaced by local measurements W <g> W. 
With Step 4 being replaced by Step 4', each pairs in trash 
cans are measured two times, the first is WW, the second 
is W ® W . They commute, therefore one can exchange 
the order of them. More over, once we have measured 
W ® W, we do not need to measure WW, since the re- 
sult of WW has been explicitly determined already by 
the measurement W ® W . Therefore all the collective 
measurements in protocol 2 can be replaced by local mea- 
surements in each side. We obtain the following protocol 



with all measurements being local: 
Protocol 3: 

Step 1: Entanglement distribution. Step 2: Error test. 
They randomly pick out 3fc pairs and equally divide 
them into 3 groups. They take local measurement of 
X ® X, Y (gi Y, Z ® Z to each pair in group 1,2,3, re- 
spectively. They announce the measurement results and 
discard those measured qubits. If too many of the results 
from two sides disagree, the abort the protocol; otherwise 
they continue. Step 3:a.) Bit-flip error rejection. They 
randomly group the remained pairs with each group con- 
taining 2 pairs. To each 2-pair group, they collect the 
parity information to the destination pair by a Z— basis 
bi-CNOT operation. They take local measurement Z®Z 
to the destination pair and announce the measurement 
results from two sides. If they are same, they discard 
the destination pair and keep the control pair; if they are 
different they discard both pairs, b.) Phase-flip error 
rejection. They randomly group the remained pairs with 
each group containing 2 pairs. To each 2-pair group, they 
collect the X— basis parity information to the destination 
pair by a A— basis bi-CNOT operation. They measure 
X ® X to the destination pair and announce the mea- 
surement results from two sides. If they are same, they 
discard the destination pair and keep the control pair; if 
they are different they discard both pairs. They do op- 
erations in a.) and b.) iteratively and finally there are 
m pairs remained outside the trash cans. Step 4: They 
measure Z ® Z to each of the remained m pairs and use 
the result as an m— bit final key. 

So far we have given a detailed and rigorous proof of 
the entanglement purification and security of QKD with 
2-CC. There are two important issues in the reduction. 
The first issue is the removal of the initial dark Bell mea- 
surement: this measurement commute with bi-CNOTs 
and all collective measurements of WW, therefore it can 
be delayed and removed, with the fidelity of the purifi- 
cation outcome unchanged. The second issue is, after 
removal of dark Bell measurement, any collective mea- 
surements WW can be replaced by local measurement of 
W on each side, i.e., W W, since WW and W <£> W 
commute. Therefore we propose the following general 
theorem: 

Theorem: Suppose we have certain fidelity result for 
the final pairs through a certain purification protocol with 
product form of state for the raw pairs. We must have 
the same fidelity result for the same protocol with what- 
ever form of state for the raw pairs, provided that the 
protocol satisfies the following conditions: (1) All quan- 
tum operations needed are not more than bi-CNOTs and 
local measurements on each side, i.e. {W ® W}; (2)The 
fidelity result is unchanged if we replace any local mea- 
surement W (E> W by collective measurement WW; (3) 
All WW commute with dark Bell measurement. 

Together with the main theorem in Ref [6], this the- 
orem works effectively on the security proof of any 
purification-based QKD protocol. We can just consider 
the conditional purification first: the special case of prod- 
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uct state for the raw pairs and consider the fidelity re- 
sult of purification. After that, we use our theorem and 
the main theorem in Ref [6] to reduce it to the uncondi- 
tional entanglement purification and moreover, prepare- 
and-measure QKD protocol. 

To reduce protocol 3 to a prepare-and-measure proto- 
col, we only need to replace the Phase-flip rejection part 
in Step 3 with 3-pair phase error correction used in Ref 
[6]. There are only bi-CNOTs and collective measure- 
ments X ® X, Z ® Z involved [6]. According to our theo- 
rem, the purification must be also unconditional. There- 
fore the unconditional security of QKD [6,9,10] proto- 
cols with 2-CC is confirmed. Similarly, the entanglement 
purification protocol with hashing [2] and the one with 
quantum error correction code [5] also only contains bi- 
CNOTs and local measurement W <8> W therefore the fi- 
delity result of the protocol is unconditionally true with 
whatever initial state. The issue of side information of 
Shor-Preskill protocol has been studied by Hwang [11]. 
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